CVE-2017-7221

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• OpenText Documentum Content Server - dm_bp_transition.ebs docbase Method Arbitrary Code Execution2017-04-25 · webapps · multiple

Impact

OpenText Documentum Content Server has an inadequate protection mechanism against SQL injection, which allows remote authenticated users to execute arbitrary code with super-user privileges by leveraging the availability of the dm_bp_transition docbase method with a user-created dm_procedure object, as demonstrated by use of a backspace character in an injected string. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2513.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://seclists.org/fulldisclosure/2017/Apr/97
• http://www.securityfocus.com/bid/98038
• https://www.exploit-db.com/exploits/41928/
• http://seclists.org/fulldisclosure/2017/Apr/97
• http://www.securityfocus.com/bid/98038
• https://www.exploit-db.com/exploits/41928/